Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(583)

Unified Diff: src/hydrogen-bce.cc

Issue 1023123003: Ensure we don't overflow in BCE (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-bce-underflow.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen-bce.cc
diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index 18bd0affb6ee2d2ba7a29e6000f576cc23352784..3bf8e9f03904c76ca9ee406cf5a4dbfed517148b 100644
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -56,7 +56,8 @@ class BoundsCheckKey : public ZoneObject {
constant = HConstant::cast(check->index());
}
- if (constant != NULL && constant->HasInteger32Value()) {
+ if (constant != NULL && constant->HasInteger32Value() &&
+ constant->Integer32Value() != kMinInt) {
*offset = is_sub ? - constant->Integer32Value()
: constant->Integer32Value();
} else {
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-bce-underflow.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698